search

apache / druid

Apache Druid: a high performance real-time analytics database.
https://druid.apache.org/
Apache License 2.0
13.39k stars 3.68k forks source link

Hide more details when showDetailedJettyErrors is enabled #15051

Closed raboof closed 1 month ago

raboof commented 11 months ago

Druid currently has the property druid.server.http.showDetailedJettyErrors [1] which when set to false, will remove the fields cause and servlet from any error response created by the Jetty layer (this property is currently set to true by default). However, this property currently does not modify, sanitize, nor hide the other fields in the Jetty error response (namely message, url, and `status).

It might make sense to sanitize all other fields (message, url, and status) so that user provided content does not get added. While this content is properly escaped, meaning there is no risk of XSS-style problems, in paranoid cases they could in theory still lead to information disclosure or other confusion.

github-actions[bot] commented 2 months ago

This issue has been marked as stale due to 280 days of inactivity. It will be closed in 4 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@druid.apache.org list. Thank you for your contributions.

github-actions[bot] commented 1 month ago

This issue has been closed due to lack of activity. If you think that is incorrect, or the issue requires additional review, you can revive the issue at any time.